---
id: "CVE-2026-116317"
page: "https://infrastack.ai/live/CVE-2026-116317"
kind: "vulnerability"
aliases: ["CVE-2026-116317"]
title: "PostgreSQL: ts_rank_cd() overflow lets a database user run code"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["database", "postgresql", "runtime", "self-hosted"]
not_affected_if: ["no-untrusted-db-users", "patched-version"]
published_at: "2026-11-12T15:17:39+00:00"
first_seen_at: "2026-11-12T15:41:54+00:00"
updated_at: "2026-11-12T15:43:34+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116317", "first_seen_at": "2026-11-12T15:41:54+00:00"}]
exploit_sources: []
---

# PostgreSQL: ts_rank_cd() overflow lets a database user run code

Link for people: https://infrastack.ai/live/CVE-2026-116317 (this .md is for agents)

A heap-based buffer overflow in PostgreSQL's ts_rank_cd() function can be triggered by an invalid tsvector containing duplicate positions. A database user who can run queries may execute arbitrary code as the operating system user that runs the database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the server version with `SELECT version();` and compare it to the fixed versions below.
- Confirm whether untrusted users can run SQL against the database.

## Fix

- PostgreSQL `18.7`
- PostgreSQL `17.12`
- PostgreSQL `16.16`
- PostgreSQL `15.20`
- PostgreSQL `14.25`

## Timeline

- 2026-11-12T15:41:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116317

## From the sources

Heap-based buffer overflow in PostgreSQL ts_rank_cd() may allow a database user to execute arbitrary code as the operating system user running the database, via an invalid tsvector containing duplicate positions.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_